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(U//FOUO) Individuals May Use Violent Tactics to Disrupt Peaceful Protests 


(U) Key Points 


(U//FOUO) Data on protests, rallies, and demonstrations are 
not systematically compiled in the United States due to the 
complexity of the task and the Constitutional protection’ 
afforded to such gatherings, but according to some past studies, 
most events were, and continue to be, peaceful. Approximately 
one-third of 1,037 events held between 2010 and 2011 (the 
latest data available) had law enforcement officers (LEOs) 
present; of those, roughly a fifth—7 percent of the total 
number of events—involved arrests. A small proportion of 
events involved property damage and violence. 





(U//FOUO) However, multiple injuries to LEOs and participants, 
including homicides, indicate criminal activities continue to be 
associated with these events. 


(U) Protesters surround a police vehicle on the 101 freeway near downtown 
Los Angeles on 27 May 2020. Image: Los Angeles Times. 


(U//FOUO) LEOs should be aware of the tactics, techniques, and procedures (TTPs) employed by criminally-minded actors to 
devolve peaceful protests into violence. 


e (U//FOUO) Pre-Incident Indicators | May include pre-staging equipment and weapons near protest sites, extensive 
reconnaissance, and doxing (public release of private, identifying information about opponents). 


e (U//FOUO) Improvised Weapons | Misuse of common household tools and chemicals, such as hammers and chisels, 
spray paint and balloons filled with paint, bear and pepper spray, and improvised incendiary devices; and opportunistic 
use of on-site materials such as pavement, bricks, street furniture, garbage cans, and barricades. 


e (U//FOUO) Tactical Organization | Use of social media and encrypted apps to communicate and direct ground 
movement for violent acts; use of area denial, reserves, and group tactics to split and regroup to circumvent law 
enforcement crowd control and dispersal tactics. 


e (U//FOUO) Identity Obstruction | The COVID-19 guidance from public health authorities to wear face coverings makes 
it difficult to identify violent individuals and, later, bring them to prosecution. The wide-spread use of face coverings 
may embolden some individuals to escalate violence. 


i (U) Disclaimer: The First Amendment to the US Constitution protects individuals’ rights to peacefully assemble, speak, and petition the 
government, and prohibits the US Congress from enacting legislation to abridge this right. The right to assemble is not absolute, however, and 
government officials can impose restrictions on the time, place, and manner of peaceful assembly, often in the form of requirements to obtain a 


permit. The First Amendment does not provide the right to conduct an assembly at which there is a clear and present danger of riot, disorder, or 
interference with traffic on public streets, or other immediate threat to public safety and order. The JRIC is prohibited from monitoring protests and 
activities protected by the First Amendment, absent evidence of a criminal or terrorist nexus. 
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(U) Commonly Used Tactics, Techniques, and Procedures (TTPs) 


(U//FOUO) The review of TTPs previously used by violent actors, revealed some common trends. Familiarity with TTPs 
outlined below may improve the safety posture of LEOs and other first responders. 


(U//FOUO) 
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Extensive reconnaissance of the “area of operation” to identify escape routes, dead ends, cameras, 
possible police staging areas, target selection, and ad-hoc resources such as barricading materials 
conducted in advance. 


Gathering information on LE personnel’s movement, numbers, use of personal protective equipment 
(e.g., donning of gas masks), and presence of transport vehicles to ascertain the likelihood of arrests or 
use of tear gas and other non-lethal chemical weapons. 


Actors try to pre-stage weapons in the vicinity of the event, including placing dowels/sticks, rocks, cans 
of spray paint, and bottles in dumpsters in the area of the planned event. 


Participants try to hide their identity by wearing scarves, hoods, balaclavas, bandannas, and masks to 
cover their faces preventing identification of individual actors. Identity obstruction is now facilitated by 
the COVID-19 guidance from public health authorities to wear face coverings. 


Participants use homemade, improvised, and manufactured weapons carried in backpacks or concealed in 
other containers. 


Weapons are divided into two categories: attack and defense. 
To attack: 
o Hammers, pickaxes, glass breakers, and chisels; 
o Balloons filled with paint, glass bottles filled with human waste, eggs; 
o Bear and pepper spray, spray paint; 
o Improvised incendiary devices (IIDs) such as Molotov cocktails, firecrackers, flares, and smoke 
bombs; 
Slingshots, bicycle locks, brass knuckles, and protest signs reinforced with screws and nails; 


Weapons of opportunity such as street furniture, rocks, chunks of asphalt, construction 
materials, shopping carts, garbage cans, dumpsters, and barricades; and 


o Whenever possible, participants pick up and throw back tear gas grenades. Some social media 
users suggested using leaf blowers to re-direct tear gas at LEOs. 


To defend: 


o Reinforced banners, sometimes placed into shopping carts in front of a group to create a rolling 
defense line; and 


o Wheelbarrows, used to advance the front line and provide defense. 


e Goggles, gas masks, gloves, and homemade body armor may be worn to protect against nonlethal 


Weapons. 
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(U//FOUO) 


COMMUNICATE 


DEPLOY AND DISRUPT 


TARGET 


Participants have been utilizing social media, Signal, Telegram, and other encrypted applications (apps) 
to communicate. 


Nefarious actors may use police scanners to stay abreast of LE communications and tactics during 
events. 


“Cuckoo” Method: Violent actors sometimes overtake lawful protests by splitting up, infiltrating the 
event in progress, and quickly regrouping in the crowd, to move to the front of the group or push 
through to reach their targets. 


“Swarming” Method: Splitting into smaller groups, creating multiple incidents, then reassembling. The 
repetitive de-grouping allows mobility for multi-prong attacks, while the subsequent re-grouping 
provides collective protection. The tactic is used to challenge, divert, and dilute LE response. 


Area Denial: Using improvised materials such as benches, paper dispensers, barricades, construction 
materials, and dumpsters, which sometimes are set on fire, to create obstacles to slow down LEOs and 
to block traffic. 


Reserves: Some criminal actors stage reserve corps in close proximity to the event and use reserves to 
surround LEOs to impede response. 


Preventing Arrest: Participants try to outrun LEOs or resist by going limp and falling to the ground, 
making the arresting officer’s job more difficult. 


Targets are selected based on what they represent in the eyes of the protestors. Police cars and 
buildings, as well as other symbols of the government are common targets. 


Attacks on LEOs are often made from a distance by hurling objects. Paint-filled balloons and bottles 
filled with human excrement can obstruct officers’ vision and force a temporary retreat, which the 
violent individuals can use to break through police lines. Participants often attempt to throw tear gas 
grenades back at officers. 


(U) Reporting, Questions, Feedback 
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